CVE-2006-10002 Memory corruption in XML::Parser

Critical 9.8 Published 19 Mar 2026 Updated 29 Apr 2026

A buffer overflow in XML::Parser for Perl can cause heap corruption and crashes, potentially leading to denial of service or code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2006-10002?

CVE-2006-10002 is a critical memory corruption vulnerability in TODDR XML::Parser, published on 19 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes.

A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.

Weakness: CWE-176, CWE-122

Which versions are affected by CVE-2006-10002?

It affects 1 product.

Products include Toddr Xml\.

How do I fix CVE-2006-10002?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2006-10002 being exploited?

There is no known exploitation of CVE-2006-10002 in the wild and no public exploit code.

CVE-2006-10003 XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack Critical 9.8

Sources

Also known as DEBIAN-CVE-2006-10002, GHSA-h943-hrx6-86cq, UBUNTU-CVE-2006-10002.